Eric Dumazet
unread,Sep 15, 2023, 1:12:43 PM9/15/23Sign in to reply to author
Sign in to forward
You do not have permission to delete messages in this group
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to Lee Duncan, Mike Christie, Chris Leech, linux-kernel, net...@vger.kernel.org, Eric Dumazet, Eric Dumazet, James E.J. Bottomley, Martin K. Petersen, open-...@googlegroups.com, linux...@vger.kernel.org
Nothing prevents iscsi_sw_tcp_conn_bind() to receive file descriptor
pointing to non TCP socket (af_unix for example).
Return -EINVAL if this is attempted, instead of crashing the kernel.
Fixes: 7ba247138907 ("[SCSI] open-iscsi/linux-iscsi-5 Initiator: Initiator code")
Signed-off-by: Eric Dumazet <
edum...@google.com>
Cc: Lee Duncan <
ldu...@suse.com>
Cc: Chris Leech <
cle...@redhat.com>
Cc: Mike Christie <
michael....@oracle.com>
Cc: "James E.J. Bottomley" <
je...@linux.ibm.com>
Cc: "Martin K. Petersen" <
martin....@oracle.com>
Cc:
open-...@googlegroups.com
Cc:
linux...@vger.kernel.org
---
drivers/scsi/iscsi_tcp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 9ab8555180a3a0bd159b621a57c99bcb8f0413ae..8e14cea15f980829e99afa2c43bf6872fcfd965c 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -724,6 +724,10 @@ iscsi_sw_tcp_conn_bind(struct iscsi_cls_session *cls_session,
return -EEXIST;
}
+ err = -EINVAL;
+ if (!sk_is_tcp(sock->sk))
+ goto free_socket;
+
err = iscsi_conn_bind(cls_session, cls_conn, is_leading);
if (err)
goto free_socket;
--
2.42.0.459.ge4e396fd5e-goog